This looks very similar to the persistent XSS reported a while ago on the
Teampass github, is it the same vulnerability?
https://github.com/nilsteampassnet/TeamPass/issues/1244
On 25 May 2016 at 19:10, Vulnerability Lab
wrote:
> Document Title:
> ===
> Teampass v2.1.26 - Stored Cr
Title: CVE-2016-4803 dotCMS - Email Header Injection
Credit: Elar Lang / https://security.elarlang.eu
Vulnerability: Email Header Injection
Vulnerable version: before 3.5 / 3.3.2
CVE: CVE-2016-4803
Vendor: dotCMS (http://dotcms.com/)
# Description
dotCMS has an email sending functionality at path
RCE Security Advisory
https://www.rcesecurity.com
1. ADVISORY INFORMATION
===
Product:XenAPI for XenForo
Vendor URL: github.com/Contex/XenAPI
Type: SQL Injection [CWE-89]
Date found: 2016-05-20
Date published: 2016-05-23
CVSSv3 Score: 7.5 (AV:N/AC:L
Document Title:
===
Bashi v1.6 iOS - Persistent Mail Encoding Vulnerability
References (Source):
http://www.vulnerability-lab.com/get_content.php?id=1852
Release Date:
=
2016-05-25
Vulnerability Laboratory ID (VL-ID):
==
Document Title:
===
Bugcrowd Bug Bounty #7 - Persistent Web Vulnerability
References (Source):
http://www.vulnerability-lab.com/get_content.php?id=1830
ID: b40f63ed19074014df808599e44684f6a18bb6f4f51cf21948ef78df2f56c13b
Release Date:
=
2016-05-10
Document Title:
===
Teampass v2.1.26 - Stored Cross Site Scripting Vulnerability
References (Source):
http://www.vulnerability-lab.com/get_content.php?id=1845
Release Date:
=
2016-05-24
Vulnerability Laboratory ID (VL-ID):
=
Document Title:
===
Teampass v2.1.25 - Unauthenticated Access Vulnerability
References (Source):
http://www.vulnerability-lab.com/get_content.php?id=1844
Release Date:
=
2016-05-18
Vulnerability Laboratory ID (VL-ID):
==
Document Title:
===
Teampass v2.1.25 - Arbitrary File Download Vulnerability
References (Source):
http://www.vulnerability-lab.com/get_content.php?id=1843
Release Date:
=
2016-05-17
Vulnerability Laboratory ID (VL-ID):
=
